- NANOG - lists.nanog.org

Asian exchange points
by Richard A Steenbergen 12 May '02

12 May '02

I know this isn't quote North American, but does anyone know what major exchange points exist in Asia? The largest one I've found so far is JPIX, which seems to move a fair amount of traffic (http://www.jpix.co.jp/en/techncal/traffic.html) Any other major ones? -- Richard A Steenbergen <ras(a)e-gerbil.net> http://www.e-gerbil.net/ras PGP Key ID: 0x138EA177 (67 29 D7 BC E8 18 3E DA B2 46 B3 D8 14 36 FE B6)

7 8

New SubSeven outbreak?
by Jeff Workman 12 May '02

12 May '02

All, I have seen 6 portscans looking for SubSeven on a /24 in the past 24 hours. It'd been a while since I had seen *any*, now I'm seeing all these. Is this a new outbreak/vulnerability, or have I just been lucky? Has anybody else seen an increase in scans on tcp port 27374? I scanned through BugTraq and didn't see any mention of anything there. -J -- Jeff Workman | jworkman(a)pimpworks.org | http://www.pimpworks.org

2 2

Re: anybody else been spammed by "no-ip.com" yet?
by Gregory Hicks 11 May '02

11 May '02

> Date: Fri, 3 May 2002 15:27:08 -0700 (PDT) > From: Scott Granados <scott(a)graphidelix.net> > > I realize this statement I'm about to make is going to open a huge... > can o worms but ... and hoefully everyone knows I mean this in the most > friendly responsible way ever but I'm not sure entirely what the big > deal with spam is. Honestly sure I get it like everyone else, in some [...snip...] > money. Today with flat rate access and many people not paying on a per > packet basis it seems to me that the responsibility lies with the end > user to filter properly and or dress that delete key. I always shut [...snip...] The problem with this is that, yes, to the END USER, there is no direct cost involved. However, in order to maintain the same level of service, the ISP is forced to go get a bigger pipe and/or bigger, faster routers and/or servers. (Raises prices a bit per account) The transit provider raises the costs to the ISP because the packet count has gone way up. The backbone provider has equipment running a bit hotter because of the increased packet count. This may cause them to either increase the bill to the transit provider and/or procure bigger and better equipment (to handle the load) before their planned replacement time... The peers to this ISP are forced to get either bigger pipes and/or more costly equipment (routers) in order to handle the increased packet count they might be seeing. In all of this, the bozo (well..., 'user' really) originating the email (well, spam) has not paid a thing other than a temporary interruption in service for one of his throw-away accounts and is still paying a 'flat rate' for the POP (dial-in) service that HIS isp is providing. For snail mail junk mail (aka spam), the mailer bears ALL of the costs and, if there is insufficient returns on their junk mail, is forced to stop. A 'spammer' does not see these costs and thus has no incentive to find another model to do business. We get, for our 7K users, upwards of 25,000+ unwanted messages per day that make it past our not so rigid filters. My $0.02 worth. Use the delete key... Regards, Gregory Hicks > > On Fri, 3 May 2002, Mitch Halmu wrote: > > > > > > > On Fri, 3 May 2002, Paul Vixie wrote: > > > > > > I hate to sound like the big idiot here, but what exactly in the email > > > > you received indicates no-ip.com spammed? It looks to me like you just > > > > have some secret "admirer" who thought you wanted a no-ip.com account, > > > > and no-ip.com emailed you to confirm that you do want the account. > > > > > > spam is like pollution in that (a) whenever you're not sure if you're > > > doing it, you probably are, and (b) if everybody did whatever it is, > > > life would be universally worse for, well, everybody. > > > > > > > Random disclaimer: Yes, we're a competitor of no-ip.com's... And yes, we > > > > used to send similar emails to people signing up for an account, > > > > although nowadays instead of sending them an initial password we send a > > > > confirm URL instead. > > > > > > that's the right approach. no-ip's problem was they presumed my permission. > > > > > > > You don't even have to be in the "big idiot" league to figure out that in > > both the "wrong" and the "right" approach as sanctioned above by a higher > > authority, an email message (aka spam) is sent to the presumed subscriber. > > > > One sends a password, one asks for permission to issue a password on their > > site. What's the difference in the annoy factor, if indeed one were to be > > subscribed by a secret "admirer"? > > > > Mr. Halmu chose to think, rather than bindly obey... > > > > --Mitch > > NetSide

29 47

Re: ratios
by Dean S Moran 11 May '02

11 May '02

Peter Jansen wrote: >Scott: >Have a look at our peering policy at www.cw.com/peering. It will >provide you with some information on peering with large networks. This should read: "Have a look at our peering policy at www.cw.com/peering if you want to see a prime example of how *not* to develop your peering policy." Peter, I can't believe you have the testicular fortutude to come on this list with this garbage. Do you think we have forgotten the PSI/C&W peering fiasco? Dude, you had *paying* customers who depended on having routes into AS174, and you turned your back on them, knowing damn good and well that PSI was in no position to purchase transit. In fact, I'm surprised to see that you're still a C&W employee after all that mess. Plus, wtf is this clause about announcing 5000 routes? What a crock of s**t! This really encourages aggregation, doesn't it? You'd think, after all of the Exodus customers jumping ship after C&W bought them, that you'd start rethinking your business practices. People want, and are willing to pay for, a well connected network, and AS3561 isn't, at least not to the outside world. Also, I would like to point out that if you're mostly content, I doubt you'll ever be able to meet C&W's peering criteria because they have practically no eyeballs. Their wholesale dial division is pretty much extinct, and they seem to be leaning more toward hosting than selling T1s to mom and pop dialup ISPS. It's a great big catch-22 any way you look at it, and I hate you, Peter Jansen, for it. There's a special level of hell for people like you when you die. Dean >Regards > >Peter Jansen >Global Peering >Cable & Wireless > > > > > >Date: Tue, 07 May 2002 13:30 -0400 (EDT) >From: Scott Granados <scott(a)graphidelix.net> >To: nanog(a)merit.edu >Sender: owner-nanog(a)merit.edu >Delivered-to: nanog-outgoing(a)trapdoor.merit.edu >Delivered-to: nanog(a)trapdoor.merit.edu >Delivered-to: nanog(a)merit.edu >Subject: ratios > > >I'm not overly familiar with this but I wondered if someone could detail >for me the basics of using ratios to determine elegibility to peer? I >have heard that some carrers especially the largest require a specific >ratio is this in fact true and is the logic as simple as just insuring >equal use of the peer? > >Thanks > >Scott _____________________________________________ Free email with personality! Over 200 domains! http://www.MyOwnEmail.com

11 11

Re: Where did sbcglobal.net go?
by ren＠internet.rockstar.org 11 May '02

11 May '02

I think Len Rose also mentioned this morning that Network Solutions has an MX issue. Network Solutions is working on it, has been for several hours now. sbcglobal.net is being hard coded into our DNS servers so that the impact will be less severe to customers. Sorry Mike <G> -ren(a)sbc.com On Sat, 11 May 2002, "Michael L. Barrow" wrote > > > Does anyone know if SBC/PacBell dropped the sbcglobal.net domain name? Since > late yesterday, it's been gone from the root nameservers..... > > > $ dig @a.gtld-servers.net -t ns sbcbglobal.net > > ; <<>> DiG 9.2.0 <<>> @a.gtld-servers.net -t ns sbcbglobal.net > ;; global options: printcmd > ;; Got answer: > ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28110 > ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 > > ;; QUESTION SECTION: > ;sbcbglobal.net. IN NS > > ;; AUTHORITY SECTION: > net. 86400 IN SOA A.GTLD-SERVERS.net. > NSTLD.VERISIGN-GRS.COM. 2002051100 1800 900 604800 86400 > > ;; Query time: 93 msec > ;; SERVER: 192.5.6.30#53(a.gtld-servers.net) > ;; WHEN: Sat May 11 10:08:16 2002 > ;; MSG SIZE rcvd: 105 > -- > Michael L. Barrow <michael(a)mlbarrow.com> > P: 805-566-0885

1 0

Where did sbcglobal.net go?
by Michael L. Barrow 11 May '02

11 May '02

Does anyone know if SBC/PacBell dropped the sbcglobal.net domain name? Since late yesterday, it's been gone from the root nameservers..... $ dig @a.gtld-servers.net -t ns sbcbglobal.net ; <<>> DiG 9.2.0 <<>> @a.gtld-servers.net -t ns sbcbglobal.net ;; global options: printcmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 28110 ;; flags: qr aa rd; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;sbcbglobal.net. IN NS ;; AUTHORITY SECTION: net. 86400 IN SOA A.GTLD-SERVERS.net. NSTLD.VERISIGN-GRS.COM. 2002051100 1800 900 604800 86400 ;; Query time: 93 msec ;; SERVER: 192.5.6.30#53(a.gtld-servers.net) ;; WHEN: Sat May 11 10:08:16 2002 ;; MSG SIZE rcvd: 105 -- Michael L. Barrow <michael(a)mlbarrow.com> P: 805-566-0885

1 0

Network Solutions primary MX servers NFG
by Len Rose 11 May '02

11 May '02

NSI's primary MX mail servers aren't functioning. We've had problems sending mail since approx. 1800 EST yesterday. We've tested from 4 seperate physical networks all seem to be using alter.net to reach NSI. I tried calling but can't reach anyone with a clue. Len

1 0

Routing problem
by Arturo Lev Servin Niembro 11 May '02

11 May '02

Hi, I have a strange question because this is not very common. Lets asume the following scenario to simplify it: net A -- RTA --- RT1-ISP1 --- IP Cloud --- RT2-ISP1 -- RTB -- net b --- RT1-ISP2 --- IP cloud --- RT2-ISP2 -- RTA and RTB are in differents ASs. ISP1 is preferred via BGP (local preference). Sometimes we lost reachability between net A and net B but we can stiil see the routes trough ISP1, so the BGP can not converge to ISP2. The problem is because the ISP1 have troubles with their IP-MPLS network, so, sometime they lost traffic. Do you now about some trick that can be used to know that the path to net b is not good despite the route is still in RTA? I was thinking to force the loopback from ISP1 to be learned in RTA to some route learned from RTB, but how. I think that if I make a tunnel interface it would still depend from BGP to work and BGP depend form tunnel, so it would not work. Any idea that do not imply to change ISP1 nor use ISP2 as default? Thanks in Advance, -as

2 1

OT: Changing NIC handle info
by Jason Lewis 11 May '02

11 May '02

I can't find info on network solutions website for changing info for my NIC handle? What is the deal? I figured I would send an empty messages to hostmaster(a)networksolutions.com and get some info, but the email it send back is full of dead links. For the life of me, I can't find and info on where all the templates are. Anyone still using the templates? jas

5 7

Re: Earthlink SMTP for Mobile Users
by Crist J. Clark 10 May '02

10 May '02

I was stuck in a dial-up-only hell for a few months and used quite a bit of Earthlink dial-up. I during that time, I did a variety of tinkering of the email headers (like masquerading envelopes). It sure didn't seem to me that Earthlink cared at all what domain was in the return path. Their SMTP servers would relay _anything_ provided you're source IP was in their IP-space. So, AFAIK, you can do whatever you want with respect to outgoing mail (any source domain in the envelope or headers that you want) and Earthlink's SMTP servers will relay it. Not that I didn't get annoyed with the blocking from time to time. Sometimes I wanted to talk directly to a remote SMTP server with telnet to debug a client's setup or see if they were the open relay I was getting SPAM from. IIRC, you get ICMP admin-prohibited messages back when you try to connect to port 25. But I probably have to say that I think Earthlink is doing the right thing, IMHO. Aren't the other big US dial-up providers doing this kind of thing? I assumed they all were. Despite the continuous rise in total SPAM levels, don't see very much SPAM from the US mega-huge dial-ups anymore. -- Crist J. Clark | cjclark(a)alum.mit.edu | cjclark(a)jhu.edu http://people.freebsd.org/~cjc/ | cjc(a)freebsd.org

2 1